运行中的托管实例应用最新环境

[earayu]

Why

The control plane persists each tenant's managed environment in env.json, but a running dsh process keeps the environment it received at spawn time. Updating MCP, LLM, or ApeMind API settings therefore changed the persisted projection without changing the live process until a later cold start.

What changed

• Compare the incoming managed environment with the persisted snapshot during ensure.
• Restart a running dsh when that snapshot changes, then start it with the new projection before ensure returns.
• Keep identical snapshots idempotent so repeated ensure calls do not restart a live instance.
• Document the new runtime behavior and add a regression test covering persistence, no-op refresh, and live-process replacement.

Validation

• npm run typecheck
• npm test (70 passed)
• npm run build
• git diff --check

Scope and remaining risk

This changes only the host-agent projection path. env.json remains the persisted source for derived files, and no deployment or release artifact is changed here. A new Computer image must be built and released by the normal release process before this behavior reaches a deployed environment.